Zimbra attacks breach 270+ servers

Attackers have already breached more than 270 Zimbra servers in an ongoing wave of remote code execution (RCE) attacks, according to new scans from threat watchdog Shadowserver. The compromises target a high-severity vulnerability in the Zimbra Collaboration Suite (ZCS), which is used by hundreds of millions of people and organizations worldwide, including thousands of businesses and hundreds of government agencies.

The Flaw: Command Injection in SNMP

The vulnerability, tracked as CVE-2026-73570, allows unauthenticated attackers to execute code remotely by exploiting a command injection weakness in the SNMP monitoring component, but only when SNMP notifications are enabled. Synacor, the company behind Zimbra, patched the flaw with the release of ZCS version 10.1.20 on July 20.

The vulnerability is rated high severity, and its exploitation can lead to full server compromise, potentially exposing sensitive email data.

Wiki-style: First Flagged by CERT Polska

CERT Polska, the Polish Computer Emergency Response Team, first flagged the flaw as targeted in the wild last Monday. The agency warned security teams to check their logs for suspicious activity, including the Zimbra service restarting unexpectedly, and for files created in specific folders by the user 'zimbra' over the last 30 days. Those folders include /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

This early warning gave administrators a head start on detecting potential compromises before the scale of the attacks became clear.

CISA Adds to KEV Catalog, Orders Patching

Following CERT Polska's warning, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its KEV catalog, a list of known exploited vulnerabilities that federal agencies must remediate. CISA also ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to patch their systems within three days, by August 24.

This move signals the severity of the threat and the urgency for government systems to be secured.

Shadowserver Scans Reveal Scale

On Monday, Shadowserver reported that hundreds of Internet-exposed Zimbra instances had already been breached in attacks exploiting the flaw. In a warning, Shadowserver said, "Zimbra compromises associated with CVE-2026-73570 exploitation are spreading. 274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22."

Zimbra compromises associated with CVE-2026-73570 exploitation are spreading. 274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22.

— Shadowserver

The same scans also found at least 8,200 unpatched instances. Shadowserver noted that this "does not mean exploitable as the vuln is in a non default config," but the large number of unpatched servers remains a concern.

Historical Targeting of Zimbra

Zimbra vulnerabilities have long been a favorite target for both cybercriminals and state-sponsored hacking groups. In recent years, they have been frequently exploited to steal emails containing sensitive data from vulnerable servers.

Most recently, in March, researchers at Seqrite Labs spotted APT28, a Russian military intelligence hacking group, abusing a stored cross-site scripting (XSS) Zimbra vulnerability to breach Ukrainian government servers. Earlier, in October 2024, U.S. and UK cyber agencies warned that Russian Foreign Intelligence Service hackers (tracked as APT29, Midnight Blizzard, and Cozy Bear) had compromised Zimbra servers using a ZCS flaw previously exploited to steal email account credentials.

Russian Winter Vivern cyber spies also exploited a reflected XSS vulnerability to steal emails from NATO-aligned email accounts in attacks targeting Zimbra webmail portals.

Key Statistics

• 270+ Zimbra instances compromised in ongoing attacks
• 8,200+ unpatched instances exposed
• Patch released July 20, 2026 (ZCS 10.1.20)
• CISA orders FCEB agencies to patch by August 24, 2026

Implications for Administrators

The ongoing exploitation of CVE-2026-73570 underscores the critical importance of promptly applying security patches, especially for internet-facing systems. The fact that the vulnerability is in a non-default configuration may lead some administrators to assume they are not at risk, but the evidence of active exploitation suggests that many organizations have enabled SNMP notifications without fully understanding the associated risk.

For organizations using Zimbra, the immediate steps are clear: verify that you are running ZCS version 10.1.20 or later, check logs for indicators of compromise, and if any suspicious activity is found, treat it as a potential breach and investigate thoroughly. The scale of the compromises—over 270 servers—indicates that attackers are actively scanning for vulnerable systems and moving quickly to exploit them.

Beyond patching, this incident highlights the broader trend of email servers being prime targets for espionage and data theft. The repeated targeting of Zimbra by state-sponsored groups like APT28 and APT29 suggests that attackers value the sensitive communications these servers hold. As such, organizations should consider additional security measures, such as network segmentation, monitoring for unusual SNMP activity, and regular security audits.

The next few weeks will be critical as security teams race to patch vulnerable servers before attackers find them. The fact that CISA has ordered federal agencies to patch within three days reflects the urgency of the situation. For the wider community, this serves as a reminder that even a vulnerability in a non-default configuration can be actively exploited if the conditions are right.